Competing methods: We compare our work with baseline approaches which do not involve redundancy or majority voting. Their aggregation is applied directly to the \(K\)  gradients returned by the workers (\(f=K\) , \(c_{\mathrm {max}}^{(q)}=q\)  and \(\epsilon =q/K\) ). We have tested median-of-means [1]}, Bulyan [2]} and Multi-Krum [3]}. If \(c_{\mathrm {max}}^{(q)}\)  is the number of adversarial computations then Bulyan requires at least \(4c_{\mathrm {max}}^{(q)}+3\)  total number of computations while the same number for Multi-Krum is \(2c_{\mathrm {max}}^{(q)}+3\) . These constraints make these methods inapplicable for larger values of \(q\)  for which our method is robust. The second class of comparisons is with methods that use redundancy and specifically DETOX [4]} for which we show that it can easily fail under malicious scenarios for large \(q\) .
